Extracted

• • Target
    bec986c8f00fca6c87865a1902f9d2c815e023c1e085df616481446fc4160038
  • Size 4.2MB
  • SHA256 bec986c8f00fca6c87865a1902f9d2c815e023c1e085df616481446fc4160038
  • MD5 910ecf7e9e781677247243869d7c5602
  • SHA1 93be680be56def9c657a2db163fa12fb5621ceb6
  • SHA512 05745bb7d0ebdd75d91a79748b5fa0bea718e997bfd63e95bf6d0bd1552a8b3edcc1f0d794726babd4f217c23af1920d310f72be0c1d2492d1614aaf2bdcfa7f
  • SSDEEP 98304:LCANLVQMZbgv99dDHWYS4f078AB1UX0RWmvAb/oAM:uA9P+jGtUX0BIb/fM
  • TLSH
    T1871633007BAB8879E83727B859E09BA1CED6DEF3A134456725380A3F5DF77C10966306
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverydropperexecutiongluptebametasploitloaderpersistenceprivilege_escalationrootkitspywaretrojan

  • Family: Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Glupteba payload

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Manipulates WinMonFS driver.

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitdefense_evasion
  behavioral1